Reducing Attack Surface of a Web Application by Open Web Application Security Project Compliance

被引：3
|
作者：
Goswami, Sumit [1 ]
Krishnan, Nabanita R. [1 ]
Mukesh [1 ]
Swarnkar, Saurabh [2 ]
Mahajan, Pallavi
机构：
[1] DRDO, Directorate Management Informat Syst & Technol, New Delhi, India
[2] IAP Co Pvt Ltd, Gurgaon, India
来源：
DEFENCE SCIENCE JOURNAL | 2012年 / 62卷 / 05期
关键词：
Attack surface; DRDO Intranet; project management; open web application security project; security audit; security compliance; SOFTWARE;
D O I：
10.14429/dsj.62.1291
中图分类号：
O [数理科学和化学]; P [天文学、地球科学]; Q [生物科学]; N [自然科学总论];
学科分类号：
07 ; 0710 ; 09 ;
摘要：
The attack surface of a system is the amount of application area that is exposed to the adversaries. The overall vulnerability can be reduced by reducing the attack surface of a web application. In this paper, we have considered the web components of two versions of an in-house developed project management web application and the attack surface has been calculated prior and post open web application security project (OWASP) compliance based on a security audit to determine and then compare the security of this Project Management Application. OWASP is an open community to provide free tools and guidelines for application security. It was observed that the attack surface of the software reduced by 45 per cent once it was made OWASP compliant. The vulnerable surface exposed by the code even after OWASP compliance was due to the mandatory access points left in the software to ensure accessibility over a network.
引用
收藏
页码：324 / 330
页数：7
相关论文
共 50 条
  • [31] Web Application Security: Threats, Countermeasures, and Pitfalls
    Huang, Hsiu-Chuan
    Zhang, Zhi-Kai
    Cheng, Hao-Wen
    Shieh, Shiuhpyng Winston
    COMPUTER, 2017, 50 (06) : 81 - 85
  • [32] Web Application Security using JS']JSFlow
    Hedin, Daniel
    Sabelfeld, Andrei
    2015 17TH INTERNATIONAL SYMPOSIUM ON SYMBOLIC AND NUMERIC ALGORITHMS FOR SCIENTIFIC COMPUTING (SYNASC), 2016, : 16 - 19
  • [33] Static Security Evaluation of an Industrial Web Application
    Welearegai, Gebrehiwet B.
    Schlueter, Max
    Hammer, Christian
    SAC '19: PROCEEDINGS OF THE 34TH ACM/SIGAPP SYMPOSIUM ON APPLIED COMPUTING, 2019, : 1952 - 1961
  • [34] Survey of Web Application and Internet Security Threats
    Abusaimeh, Hesham
    Shkoukani, Mohammad
    INTERNATIONAL JOURNAL OF COMPUTER SCIENCE AND NETWORK SECURITY, 2012, 12 (12): : 67 - 76
  • [35] Frameworks for SQL Retrieval on Web Application Security
    Kim, Haeng Kon
    INTERNATIONAL MULTICONFERENCE OF ENGINEERS AND COMPUTER SCIENTISTS (IMECS 2010), VOLS I-III, 2010, : 748 - 752
  • [36] ASIDE: IDE Support for Web Application Security
    Xie, Jing
    Chu, Bill
    Lipford, Heather Richter
    Melton, John T.
    27TH ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE (ACSAC 2011), 2011, : 267 - 276
  • [37] Security risk analysis in web application design
    Hewett, Rattikorn
    Kijsanayothin, Phongphun
    Peters, Meinhard
    WEBIST 2007: PROCEEDINGS OF THE THIRD INTERNATIONAL CONFERENCE ON WEB INFORMATION SYSTEMS AND TECHNOLOGIES, VOL IT: INTERNET TECHNOLOGY, 2007, : 28 - +
  • [38] Semantic security against web application attacks
    Razzaq, Abdul
    Latif, Khalid
    Ahmad, H. Farooq
    Hur, Ali
    Anwar, Zahid
    Bloodsworth, Peter Charles
    INFORMATION SCIENCES, 2014, 254 : 19 - 38
  • [39] Web Application Security, A Beginner's Guide
    Sklavos, Nicolas
    INFORMATION SECURITY JOURNAL, 2014, 23 (1-2): : 51 - 51
  • [40] A testing framework for Web application security assessment
    Huang, YW
    Tsai, CH
    Lin, TP
    Huang, SK
    Lee, DT
    Kuo, SY
    COMPUTER NETWORKS, 2005, 48 (05) : 739 - 761
12345